Description
Path traversal and content injection in JobRunnerBackground.aspx in DynamicWeb 8 (all) and 9 (<9.19.7 and <9.20.3) allows unauthenticated attackers to execute code via simple web requests
Published: 2026-02-19
Score: 10 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Patch Now
AI Analysis

Impact

DynamicWeb’s JobRunnerBackground.aspx is vulnerable to path traversal and content injection attacks that can be exploited without authentication. An attacker who sends crafted web requests can manipulate file paths and execute arbitrary code on the server, giving full control over the system. The vulnerability is classified as CWE-22, indicating a flaw in controlling access to file system paths.

Affected Systems

DynamicWeb 8 (all releases) and DynamicWeb 9 (versions prior to 9.19.7 and prior to 9.20.3) are affected. The issue resides in the JobRunnerBackground.aspx component, which is widely used across these product generations.

Risk and Exploitability

The vulnerability carries a CVSS score of 10, rating it as critical. The EPSS score is below 1%, indicating a low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, the attack vector is remote, HTTP-based, and requires no authentication, allowing any internet-exposed attacker to exploit the flaw by sending specifically crafted requests to the vulnerable endpoint.

Generated by OpenCVE AI on April 17, 2026 at 18:15 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Obtain and install the latest DynamicWeb release that addresses the JobRunnerBackground.aspx path traversal flaw (versions 9.19.7 or later, or 9.20.3 or later for earlier releases).
  • Restrict access to the /JobRunnerBackground.aspx endpoint by firewall or web‑application firewall rules, allowing only authenticated traffic and blocking path‑traversal patterns.
  • Implement strict server‑side validation of file paths used by JobRunnerBackground.aspx, ensuring that only legitimate, whitelisted directories are accessible and that file system permissions prevent arbitrary code execution.

Generated by OpenCVE AI on April 17, 2026 at 18:15 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 20 Feb 2026 10:15:00 +0000

Type Values Removed Values Added
First Time appeared Dynamicweb
Dynamicweb dynamicweb
Vendors & Products Dynamicweb
Dynamicweb dynamicweb

Fri, 20 Feb 2026 01:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 19 Feb 2026 08:00:00 +0000

Type Values Removed Values Added
Description Path traversal and content injection in JobRunnerBackground.aspx in DymaicWeb 8 (all) and 9 (<9.19.7 and <9.20.3) allows unauthenticated attackers to execute code via simple web requests Path traversal and content injection in JobRunnerBackground.aspx in DynamicWeb 8 (all) and 9 (<9.19.7 and <9.20.3) allows unauthenticated attackers to execute code via simple web requests

Thu, 19 Feb 2026 07:15:00 +0000

Type Values Removed Values Added
Description Path traversal and content injection in JobRunnerBackground.aspx in DymaicWeb 8 (all) and 9 (<9.19.7 and <9.20.3) allows unauthenticated attackers to execute code via simple web requests
Title Unauthenticated RCE in Dynamicweb 9 and Dynamicweb 8
Weaknesses CWE-22
References
Metrics cvssV4_0

{'score': 10, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H'}

Subscriptions

Dynamicweb Dynamicweb
cve-icon MITRE

Status: PUBLISHED

Assigner: NCSC-FI

Published:

Updated: 2026-02-19T21:21:36.185Z

Reserved: 2026-02-19T05:59:41.416Z

Link: CVE-2026-2731

cve-icon Vulnrichment

Updated: 2026-02-19T21:21:30.296Z

cve-icon NVD

Status : Deferred

Published: 2026-02-19T07:17:50.817

Modified: 2026-04-15T00:35:42.020

Link: CVE-2026-2731

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-17T18:15:26Z

Weaknesses